MySQL Bugs: #74500: Assertion `src' failed in my_strnxfrm_unicode (sig 6 -strings/ctype-utf8.c:5151)

Bug #74500	Assertion `src' failed in my_strnxfrm_unicode (sig 6 -strings/ctype-utf8.c:5151)
Submitted:	22 Oct 2014 9:56	Modified:	17 Nov 2014 15:18
Reporter:	Ramesh Sivaraman	Email Updates:
Status:	Closed	Impact on me:	None
Category:	MySQL Server: DML	Severity:	S3 (Non-critical)
Version:	5.6.20-debug	OS:	Linux (CentOS 7)
Assigned to:	Tor Didriksen	CPU Architecture:	Any

Description:
mysqld: /ssd/ramesh/mysql-server/mysql-5.6/strings/ctype-utf8.c:5151: my_strnxfrm_unicode: Assertion `src' failed.
09:48:26 UTC - mysqld got signal 6 ;

**** GDB info

#0  0x00007f16ee993771 in pthread_kill () from /lib64/libpthread.so.0
#1  0x0000000000a9035e in my_write_core (sig=6) at /ssd/ramesh/mysql-server/mysql-5.6/mysys/stacktrace.c:422
#2  0x0000000000723688 in handle_fatal_signal (sig=6) at /ssd/ramesh/mysql-server/mysql-5.6/sql/signal_handler.cc:230
#3  <signal handler called>
#4  0x00007f16ed79f5c9 in raise () from /lib64/libc.so.6
#5  0x00007f16ed7a0cd8 in abort () from /lib64/libc.so.6
#6  0x00007f16ed798536 in __assert_fail_base () from /lib64/libc.so.6
#7  0x00007f16ed7985e2 in __assert_fail () from /lib64/libc.so.6
#8  0x0000000000e42902 in my_strnxfrm_unicode (cs=0x172c260 <my_charset_ucs2_general_ci>, dst=0x7f1652104761 "", dstlen=2, nweights=1, src=0x0, srclen=0, flags=192) at /ssd/ramesh/mysql-server/mysql-5.6/strings/ctype-utf8.c:5151
#9  0x0000000000917d94 in make_sortkey (param=0x7f16eef89440, to=0x7f1652104761 "", ref_pos=0x7f1652078cf0 "") at /ssd/ramesh/mysql-server/mysql-5.6/sql/filesort.cc:1035
#10 0x000000000091735c in find_all_keys (param=0x7f16eef89440, select=0x7f1652020da0, fs_info=0x7f16eef893d0, buffpek_pointers=0x7f16eef895e0, tempfile=0x7f16eef894c0, pq=0x0, found_rows=0x7f16eef89860) at /ssd/ramesh/mysql-server/mysql-5.6/sql/filesort.cc:814
#11 0x0000000000915b31 in filesort (thd=0x7f165b724000, table=0x7f165204da00, filesort=0x7f1652020f10, sort_positions=false, examined_rows=0x7f16eef89868, found_rows=0x7f16eef89860) at /ssd/ramesh/mysql-server/mysql-5.6/sql/filesort.cc:337
#12 0x00000000007a570f in create_sort_index (thd=0x7f165b724000, join=0x7f165201fa70, tab=0x7f16520207a0) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_executor.cc:3339
#13 0x00000000007a3245 in st_join_table::sort_table (this=0x7f16520207a0) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_executor.cc:2508
#14 0x00000000007a2d14 in join_init_read_record (tab=0x7f16520207a0) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_executor.cc:2382
#15 0x00000000007a061b in sub_select (join=0x7f165201fa70, join_tab=0x7f16520207a0, end_of_records=false) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_executor.cc:1256
#16 0x00000000007a0005 in do_select (join=0x7f165201fa70) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_executor.cc:933
#17 0x000000000079df61 in JOIN::exec (this=0x7f165201fa70) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_executor.cc:194
#18 0x00000000007fe143 in mysql_execute_select (thd=0x7f165b724000, select_lex=0x7f165b726878, free_join=true) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_select.cc:1100
#19 0x00000000007fe43f in mysql_select (thd=0x7f165b724000, tables=0x7f165201f340, wild_num=0, fields=..., conds=0x0, order=0x7f165b726a40, group=0x7f165b726978, having=0x0, select_options=2147748608, result=0x7f165201fa48, unit=0x7f165b726230, select_lex=0x7f165b726878) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_select.cc:1221
#20 0x00000000007fc4c7 in handle_select (thd=0x7f165b724000, result=0x7f165201fa48, setup_tables_done_option=0) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_select.cc:110
#21 0x00000000007d681b in execute_sqlcom_select (thd=0x7f165b724000, all_tables=0x7f165201f340) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_parse.cc:5103
#22 0x00000000007cf5cb in mysql_execute_command (thd=0x7f165b724000) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_parse.cc:2649
#23 0x00000000007d8fa4 in mysql_parse (thd=0x7f165b724000, rawbuf=0x7f165201f010 "SELECT COALESCE(c1)FROM t1 ORDER BY 1", length=37, parser_state=0x7f16eef8ae70) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_parse.cc:6245
#24 0x00000000007cc557 in dispatch_command (command=COM_QUERY, thd=0x7f165b724000, packet=0x7f165b762001 "", packet_length=37) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_parse.cc:1332
#25 0x00000000007cb646 in do_command (thd=0x7f165b724000) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_parse.cc:1034
#26 0x0000000000793a61 in do_handle_one_connection (thd_arg=0x7f165b724000) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_connect.cc:982
#27 0x000000000079354a in handle_one_connection (arg=0x7f165b724000) at /ssd/ramesh/mysql-server/mysql-5.6/sql/sql_connect.cc:898
#28 0x0000000000ad4b5c in pfs_spawn_thread (arg=0x7f16e8338b00) at /ssd/ramesh/mysql-server/mysql-5.6/storage/perfschema/pfs.cc:1860
#29 0x00007f16ee98edf3 in start_thread () from /lib64/libpthread.so.0
#30 0x00007f16ed86001d in clone () from /lib64/libc.so.6

How to repeat:
CREATE TABLE t1(c1 SET('','')CHARACTER SET ucs2);
INSERT INTO t1 VALUES(990101.102);
SELECT COALESCE(c1)FROM t1 ORDER BY 1;

same or similar to:
Bug 13358486 - WEIGHT_STRING = MY_STRNXFRM_UNICODE: ASSERTION `SRC' FAILED.

[miguel@cuzcatlan 5.6]$ bin/mysql -uroot --socket=/tmp/mysql.sock
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1
Server version: 5.6.22-debug Source distribution

Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> create database l;
Query OK, 1 row affected (0.00 sec)

mysql> use l
Database changed
mysql> CREATE TABLE t1(c1 SET('','')CHARACTER SET ucs2);
Query OK, 0 rows affected, 1 warning (0.65 sec)

mysql> INSERT INTO t1 VALUES(990101.102);
Query OK, 1 row affected, 1 warning (0.09 sec)

mysql> SELECT COALESCE(c1)FROM t1 ORDER BY 1;
ERROR 2013 (HY000): Lost connection to MySQL server during query
mysql>

Thank you for the bug report.

Verified for 5.5 and 5.7 as well.
Only debug versions are affected.
The string has length zero, so code without the assert works fine.
The string pointer should point to a "" string rather than be zero though.

Noted in 5.7.6 changelog.

For debug builds, certain queries could raise an assertion when a
internal string operation produces a NULL pointer rather than an
empty string.

A 5.5. and 5.6 backport would be appreciated, and may improve QA quality because currently this bug is filtered with a broad filter in post-crash filtering runs. Thank you!